Key developments
ICE facial app reaches local police
Wyoming Public Media's Meg Anderson reported that a newly revealed DHS Privacy Threshold Analysis describes the ICE Task Force Module, a mobile app for local police working with ICE to scan faces during community stops. The app compares scans against more than 250 million federal records, including State Department visa records and TSA Traveler Verification Service records, and stores captured photos in a DHS system for 15 years. The document says the app launched last September and is tied to the 287(g) Task Force Model, which has about 1,300 participating police agencies.
Why it matters
The program could move federal immigration face surveillance into routine local policing while retaining images of immigrants and U.S. citizens for years.
Sources & driving stories
WYOMING PUBLIC MEDIA · Meg Anderson
Wyoming Public Media coverageCISA warns after FortiBleed credential leak
BleepingComputer's Sergiu Gatlan reported that CISA urged Fortinet customers to secure FortiGate appliances after the FortiBleed leak exposed credentials tied to roughly 74,000 firewall and VPN devices. CISA said threat actors used compromised credentials to target internet-accessible Fortinet systems across government and private-sector organizations worldwide. The agency advised terminating SSL VPN and admin sessions, resetting passwords, enabling phishing-resistant MFA, reviewing logs, restricting public management interfaces, and removing unauthorized accounts.
Why it matters
A credential set of this size creates immediate account-takeover and network-intrusion risk for public agencies, companies, and critical infrastructure operators.
Sources & driving stories
BLEEPINGCOMPUTER · Sergiu Gatlan
BleepingComputer coverageCosta Mesa weighs ending Flock ALPR contract
Daily Pilot reported that Costa Mesa officials are considering whether to terminate the city's Flock Safety automated license plate reader contract, with a City Council vote expected July 21. Residents and immigrant-rights advocates rallied at City Hall, citing mass-surveillance concerns, possible sharing with ICE and out-of-state agencies, and California SB 34 compliance questions. The city has 46 Flock cameras, and scrutiny intensified after a former Costa Mesa officer was fired and sentenced to probation for illegally accessing Flock data in 2023 to track his wife, an ex-girlfriend, and another person.
Why it matters
The vote could become another local test of whether police ALPR networks are compatible with state privacy limits and immigration-enforcement restrictions.
Sources & driving stories
DAILY PILOT
Daily Pilot coverageWorth noting
WORTH NOTING
Vermont adds comprehensive privacy law
Troutman Privacy reported that Gov. Phil Scott signed the Vermont Data Privacy and Online Surveillance Act on June 16, making Vermont the 23rd state with a comprehensive privacy law and adding provisions on LLM training disclosures, biometric data, minors, profiling, and consumer health data.
WORTH NOTING
Kansas City plans bus face scans
Newsday reported that Kansas City, Missouri still plans to deploy SafeSpace Global facial recognition on some public buses despite Missouri declining funding for that component, with officials saying rollout could expand from nine buses to as many as 30.
WORTH NOTING
Fresh breach disclosures span sectors
New reports described possible exposure of Texas hunting and fishing license-holder data, Kodak's investigation of a ShinyHunters extortion claim involving more than 2.2 million records, and iRhythm protected health information taken from a third-party platform.
Still unclear
OPEN QUESTION
What limits govern ICE partner face scans?
The DHS document leaves unresolved whether local officers need an existing stop or suspicion before scanning faces and how oversight will work across roughly 1,300 287(g) Task Force Model agencies.
OPEN QUESTION
Will privacy law converge or fragment further?
Vermont's new law adds another state model just as industry and federal lawmakers continue debating whether a single national standard should preempt state privacy rules.
